Yesterday, we reported on the security flaw in Windows 7's UAC slider dialog, and today, Microsoft has given a response to the situation, but it doesn't seem like the company intends to fix it. "This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level." I hope this reply came from a marketing drone, because if they intend on keeping this behaviour as-is in Windows 7 RTM, they're going to face a serious shitstorm - and rightfully so. Let's hope the Sinfoskies and Larson-Greens at Microsoft rectify this situation as soon as possible.

I understand what you say, but are you sure there are no ways to prompt the execution of a VBScript by way of malware installation without prompting the OS that it's trying to run an unsigned executable?

If anything, the amount of naked_chick.jpg.vbs exploits are surely going to rise.

Either way, even if it doesn't prompt a full-blown vulnerability by itself, it gives way for a lot of exploits, and always having social engineering on your mind, you can do a lot of things, even trick people into installing things that do not have a "CLICK HERE.exe" installer, but a "CLICK HERE.vbs" installer, which can happily disable UAC and then run all the unsigned binaries it wants. I've seen my dad install all kinds of crap on his system this way, regardless of .exe extension.